CVE-2024-56333

Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS

No CVSS.

References

Link	Resource
https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219
https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Onyxia es una aplicación web que tiene como objetivo ser el nexo de unión entre múltiples tecnologías backend de código abierto para proporcionar un entorno de trabajo de última generación para los científicos de datos. Esta vulnerabilidad crítica permite a los usuarios autenticados ejecutar código de forma remota dentro de la API de Onyxia, lo que puede tener consecuencias como el acceso no autorizado a otros entornos de usuario y ataques de denegación de servicio. Este problema se ha corregido en las versiones de la API 4.2.0, 3.1.1 y 2.8.2. Se recomienda a los usuarios que actualicen la versión. No se conocen workarounds para esta vulnerabilidad.

20 Dec 2024, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-20 20:15

Updated : 2026-06-17 08:12

NVD link : CVE-2024-56333

Mitre link : CVE-2024-56333

CVE.ORG link : CVE-2024-56333

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-56333", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56333", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-12-24T16:38:39.255348Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "InseeFrLab", "product": "onyxia", "versions": [{"status": "affected", "version": "< 2.8.2"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.2.0"}]}]}], "published": "2024-12-20T20:15:24.520", "references": [{"url": "https://docs.onyxia.sh/vulnerability-disclosure/known-vulnerabilities/vulnerability-20241219", "source": "security-advisories@github.com"}, {"url": "https://github.com/InseeFrLab/onyxia/security/advisories/GHSA-qmcw-h4f9-j3h3", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthorized access to other user environments and denial of service attacks. This issue has been patched in api versions 4.2.0, 3.1.1, and 2.8.2. Users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Onyxia es una aplicaci\u00f3n web que tiene como objetivo ser el nexo de uni\u00f3n entre m\u00faltiples tecnolog\u00edas backend de c\u00f3digo abierto para proporcionar un entorno de trabajo de \u00faltima generaci\u00f3n para los cient\u00edficos de datos. Esta vulnerabilidad cr\u00edtica permite a los usuarios autenticados ejecutar c\u00f3digo de forma remota dentro de la API de Onyxia, lo que puede tener consecuencias como el acceso no autorizado a otros entornos de usuario y ataques de denegaci\u00f3n de servicio. Este problema se ha corregido en las versiones de la API 4.2.0, 3.1.1 y 2.8.2. Se recomienda a los usuarios que actualicen la versi\u00f3n. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2026-06-17T08:12:03.850", "sourceIdentifier": "security-advisories@github.com"}